nobswebdev/private_image
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
96 Commits 1 Branch 0 Tags
80497177f839835c72fab234d08dbd34b4082bb1
Commit Graph
29 Commits
Author SHA1 Message Date
nobswebdev 4a534a8007 Add production deployment guide and restrict CORS to development. 
Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.
 2026-10-28 22:07:32 +01:00
nobswebdev 915d62f09a Trust nginx proxy and drop hotlink response headers from Nest. 
Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.
 2026-10-28 20:56:21 +01:00
nobswebdev 214fa0f875 Enforce maxViews atomically when reserving a view slot. 
Use a conditional UPDATE with parenthesized OR so increment only applies to the target row and fails when the view cap is reached.
 2026-10-27 22:09:48 +01:00
nobswebdev 3cf1d5e8aa Fix drop lastViewedAt migration order for fresh databases. 
Run the column drop after AddUploadTable so TypeORM does not execute ALTER before uploads exists.
 2026-10-27 22:09:45 +01:00
nobswebdev 29407814cc Add UploadCleanupService for cron purge and delete uploads. 
Move token delete and storage purge off UploadService; enforce expiry and max views on GET without purging until the scheduled cleanup job runs.
 2026-10-27 21:07:01 +01:00
nobswebdev c147a010b5 Enforce max views on access and purge after the last allowed view. 2026-10-27 18:30:35 +01:00
nobswebdev 9a2bc67b1d Reject expired uploads on ZK and hotlink GET with 404. 
Use dayjs to compare expiresAt before reading storage or incrementing view_count.
 2026-10-27 15:30:03 +01:00
nobswebdev 481eb0bcd6 Add DELETE /api/uploads/:id with delete_token and unlink ciphertext. 
Return 204 when the token hash matches; ignore missing files on unlink so the row is still removed.
 2026-10-27 15:19:25 +01:00
nobswebdev 073e6ac1f2 Increment view_count after successful ZK and hotlink GETs. 
Bump count only when ciphertext or decrypted image is ready; 404 paths do not increment. Cover both flows in UploadService tests.
 2026-10-27 15:06:26 +01:00
nobswebdev cb8a6a800d Drop lastViewedAt from uploads because inactivity cleanup is out of scope. 
Add a migration and remove the column from the Upload entity.
 2026-10-27 14:55:27 +01:00
nobswebdev bf36b1d2aa Restrict hotlink mimeType to image/* and harden image responses. 2026-10-26 23:06:23 +01:00
nobswebdev 5db90f02c5 Add GET /i/:id/:secret hotlink image decrypt stream. 2026-10-26 21:47:30 +01:00
nobswebdev 65bbc4537b add GET /api/uploads/:id for zk ciphertext JSON 
Expose ZK ciphertext and wrap fields for the viewer; return 404 for
missing, non-zk, or absent storage. Use injected upload repository and
shared isErrorEnoent for missing files.
 2026-10-26 02:11:57 +01:00
nobswebdev bd456451a4 Remove NEVER_MODE_INACTIVITY_DAYS env variable as idea of cleanup of inactive images changed 2026-10-21 15:03:53 +02:00
nobswebdev f2987da2fe update upload validation to use shared AES-GCM size constants on the backend. 2026-10-19 02:59:52 +02:00
nobswebdev d4529376c6 Add single-image zk and hotlink upload API with service tests. 
Replace batch DTOs with per-mode endpoints, persist ciphertext with file-type
checks, and return a hashed delete token for future revocation.
 2026-10-12 20:18:40 +02:00
nobswebdev 7f99256863 Verify ALTCHA before upload body parse with single-use replay store. 
Run challenge TTL and replay tracking in middleware, remove the guard, and
wire ScheduleModule for pruning used solutions.
 2026-10-12 20:18:36 +02:00
nobswebdev 96383a7426 Restructure upload validation env and colocate config types. 
Move app config shapes under types/config, replace batch upload env vars with
per-image bytes and JSON body padding, and extend IsBase64 for decoded limits.
 2026-10-12 20:18:22 +02:00
nobswebdev c762223200 Add zk and hotlink upload create DTOs with batch options. 
Split item shapes, array caps from config, and password-protected zk item transform.
 2026-10-07 00:36:16 +02:00
nobswebdev fa36b27d1b Add isBase64 and NullOr validators for upload DTOs. 
Include toBase64 helper and focused specs for base64 and null-or field rules.
 2026-10-07 00:36:13 +02:00
nobswebdev 493843cc42 Move upload caps into validation config env vars. 
Replace MAX_IMAGES_PER_UPLOAD with VALIDATION_UPLOAD_* limits mirrored on the frontend VITE_* names.
 2026-10-07 00:36:10 +02:00
nobswebdev 64180d21e7 validate env booleans as true/false strings only. 
Avoid @IsBoolean with implicit conversion mismatching isEnabled(); add tests and shared BOOLEAN_STRING_VALUES.
 2026-10-06 19:44:31 +02:00
nobswebdev 7e4a889b50 add upload rate limiter per IP to backend. 
Nest throttler with nullcart-style default profile and upload override via throttleProfiles.
 2026-10-06 18:59:44 +02:00
nobswebdev 84f8a85214 add ALTCHA verification guard for uploads. 
Verify body.altcha when ALTCHA_ENABLED; export AltchaGuard only. Drop unused StorageModule export.
 2026-10-06 15:04:31 +02:00
nobswebdev 87376ea37f add ALTCHA challenge endpoint and env config. 
GET /api/altcha/challenge, nullcart-style env validation, and ALTCHA_ENABLED wiring.
 2026-10-05 23:53:28 +02:00
nobswebdev a8070da39d add local ciphertext storage module to backend. 
Bind-mount backend/uploads in dev; path helpers with traversal guards and Jest coverage for StorageService.
 2026-10-05 23:01:31 +02:00
nobswebdev fb1cb1d6b0 add migration and entities for uploads upload_zk upload_hotlink. 2026-10-05 22:14:26 +02:00
nobswebdev 64041aa9a8 add TypeORM postgres config and migration runner. 2026-10-05 20:54:50 +02:00
nobswebdev a785ce775f add NestJS skeleton and GET /api/health-check. 
Thin API bootstrap with config module and nullcart-style health route for Docker checks.
 2026-09-27 23:05:28 +02:00